fix(deps): keep Nx major updates manual

.github/dependabot.yml

@@ -1,8 +1,8 @@
 # Every Dependabot PR triggers the full pipeline (~15 jobs), so version
 # updates are batched weekly. Nx minor+patch updates use a dedicated group so
-# official packages move together; other minor+patch updates are grouped per
-# ecosystem, and majors remain individual. Security updates are separate and
-# are not limited by this schedule; CI enforces complete Nx lockstep.
+# official packages move together; Nx majors are manual coordinated migrations,
+# and other minor+patch updates are grouped per ecosystem. Security updates are
+# separate and are not limited by this schedule; CI enforces complete Nx lockstep.
 version: 2
 updates:
     - package-ecosystem: npm
@@ -12,6 +12,13 @@ updates:
           day: monday
           time: '06:00'
       open-pull-requests-limit: 5
+      ignore:
+          - dependency-name: nx
+            update-types:
+                - version-update:semver-major
+          - dependency-name: '@nx/*'
+            update-types:
+                - version-update:semver-major
       groups:
           nx-version-updates:
               applies-to: version-updates